The TCP layer within ICMPv6 error message is wrongly parsed

[ZedongJia]

Brief description

There is a bug where the TCP layer within an ICMPv6 error message is incorrectly parsed as TCP instead of TCPerror. This occurs when the IPerror6 is followed by an IPv6 extension header.

Scapy version

2.7.0

Python version

3.11.0

Operating system

Ubuntu 22.04.5 LTS

Additional environment information

No response

How to reproduce

Here is a simple example to reproduce the bug:

# example.py
from scapy.layers.inet import TCPerror
from scapy.layers.inet6 import IPv6, IPerror6, ICMPv6DestUnreach, IPv6ExtHdrFragment
pkt = (
    IPv6(src="2001:da8::1", dst="2001:da8::5")
    / ICMPv6DestUnreach()
    / IPerror6(src="2001:da8::5", dst="2001:da8::6")
    / IPv6ExtHdrFragment(m=0, offset=0)
    / TCPerror()
)
print("The parsed packet:")
parsed_pkt = IPv6(pkt.build())
parsed_pkt.show()

Actual result

$ python3 example.py
The parsed packet:
###[ IPv6 ]###
  version   = 6
  tc        = 0
  fl        = 0
  plen      = 76
  nh        = ICMPv6
  hlim      = 64
  src       = 2001:da8::1
  dst       = 2001:da8::5
###[ ICMPv6 Destination Unreachable ]###
     type      = Destination unreachable
     code      = No route to destination
     cksum     = 0x10df
     length    = 0
     unused    = 0x0
     extpad    = b''
     ext       = None
###[ IPv6 in ICMPv6 ]###
        version   = 6
        tc        = 0
        fl        = 0
        plen      = 28
        nh        = Fragment Header
        hlim      = 64
        src       = 2001:da8::5
        dst       = 2001:da8::6
###[ IPv6 Extension Header - Fragmentation header ]###
           nh        = TCP
           res1      = 0
           offset    = 0
           res2      = 0
           m         = 0
           id        = 0
###[ TCP ]###
              sport     = ftp_data
              dport     = http
              seq       = 0
              ack       = 0
              dataofs   = 5
              reserved  = 0
              flags     = S
              window    = 8192
              chksum    = 0x3422
              urgptr    = 0
              options   = []

Expected result

The parsed packet:
###[ IPv6 ]###
  version   = 6
  tc        = 0
  fl        = 0
  plen      = 76
  nh        = ICMPv6
  hlim      = 64
  src       = 2001:da8::1
  dst       = 2001:da8::5
###[ ICMPv6 Destination Unreachable ]###
     type      = Destination unreachable
     code      = No route to destination
     cksum     = 0x10df
     length    = 0
     unused    = 0x0
     extpad    = b''
     ext       = None
###[ IPv6 in ICMPv6 ]###
        version   = 6
        tc        = 0
        fl        = 0
        plen      = 28
        nh        = Fragment Header
        hlim      = 64
        src       = 2001:da8::5
        dst       = 2001:da8::6
###[ IPv6 Extension Header - Fragmentation header ]###
           nh        = TCP
           res1      = 0
           offset    = 0
           res2      = 0
           m         = 0
           id        = 0
###[ TCP in ICMP ]###
              sport     = ftp_data
              dport     = http
              seq       = 0
              ack       = 0
              dataofs   = 5
              reserved  = 0
              flags     = S
              window    = 8192
              chksum    = 0x3422
              urgptr    = 0
              options   = []

Related resources

No response

[guedou]

You need to do `parsed_pkt.haslayer(UDPerror)`.

[ZedongJia]

You need to do parsed_pkt.haslayer(UDPerror).

Thank you for your answer. Using UDPerror is the proper way to get the UDP part in an ICMPv6 error message, but I find it doesn't work when the IPerror6 is followed by an IPv6 extension header. This phenomenon has also appeared when it is TCP. I had already updated the issue to show this before you saw the original version.

[guedou]

This seems to work as expected: ```

>> r,u = traceroute6("www.kame.net",l4=UDP()/DNS(), maxttl=2) >> r[0].answer.haslayer(UDPerror)

True ```

[ZedongJia]

This seems to work as expected:

>> r,u = traceroute6("[www.kame.net",l4=UDP()/DNS()](http://www.kame.net",l4=UDP()/DNS()), maxttl=2)
>> r[0].answer.haslayer(UDPerror)
True

Please try:

from scapy.layers.inet6 import IPv6ExtHdrFragment, traceroute6
from scapy.layers.inet import UDPerror, UDP
from scapy.layers.dns import DNS

r, u = traceroute6("www.kame.net", l4=IPv6ExtHdrFragment(m=0,offset=0) / UDP() / DNS(), maxttl=2)
print(r[0].answer.haslayer(UDPerror))

The key lies in IPv6ExtHdrFragment(m=0,offset=0)

[guedou]

That's different than your initial report that I have been investigated.

Indeed, with an extension header, there is an issue, and the behavior differs with the IPv6 header only case.

[ZedongJia]

That's different than your initial report that I have been investigated.

Indeed, with an extension header, there is an issue, and the behavior differs with the IPv6 header only case.

Thank you for your time. I'm sorry that the initial bug report I submitted was not appropriate due to my poor understanding of Scapy. Hope it will be helpful for Scapy!